fix(dev_heartbeat): use correct sh() signature, fix CLI syntax path

dev/scripts/dev_heartbeat.py

@@ -38,10 +38,10 @@ def check_build_tests():
     rc, out = sh("poetry check")
     checks.append(("poetry check", rc == 0, out))
     # 2) Fast syntax check of CLI package
-    rc, out = sh("python -m py_compile cli/aitbc_cli/__main__.py")
+    rc, out = sh("python3 -m py_compile cli/aitbc_cli/main.py")
     checks.append(("cli syntax", rc == 0, out if rc != 0 else "OK"))
     # 3) Minimal test run (dry-run or 1 quick test)
-    rc, out = sh("python -m pytest tests/ -v --collect-only 2>&1 | head -20")
+    rc, out = sh("python3 -m pytest tests/ -v --collect-only 2>&1 | head -20")
     tests_ok = rc == 0
     checks.append(("test discovery", tests_ok, out if not tests_ok else f"Collected {out.count('test') if 'test' in out else '?'} tests"))
     all_ok = all(ok for _, ok, _ in checks)
@@ -86,7 +86,7 @@ def check_vulnerabilities():
     """Run security audits for Python and Node dependencies."""
     issues = []
     # Python: pip-audit (if available)
-    rc, out = sh("pip-audit --requirement <(poetry export --without-hashes) 2>&1", shell=True)
+    rc, out = sh("pip-audit --requirement <(poetry export --without-hashes) 2>&1")
     if rc == 0:
         # No vulnerabilities
         pass